CVE-2025-24452
Published: 11 March 2025
Summary
CVE-2025-24452 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write vulnerability in InDesign by requiring identification, reporting, and patching of known flaws like CVE-2025-24452.
Provides memory safeguards that mitigate exploitation of the out-of-bounds write vulnerability by protecting against unauthorized code execution.
Enables proactive scanning to identify systems running vulnerable versions of InDesign affected by CVE-2025-24452.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an out-of-bounds write in Adobe InDesign leading to arbitrary code execution when a user opens a malicious file, directly mapping to exploitation for client execution (T1203) and user execution via malicious file (T1204.002).
NVD Description
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2025-24452 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions ID20.1, ID19.5.2, and earlier. This flaw could lead to arbitrary code execution in the context of the current user when processing malicious files.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact. Exploitation requires local access and user interaction, where an attacker with no privileges tricks a victim into opening a specially crafted file in InDesign. Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially enabling full system compromise on the affected machine.
Adobe Security Bulletin APSB25-19, available at https://helpx.adobe.com/security/products/indesign/apsb25-19.html, provides details on the vulnerability and mitigation steps, including available patches for affected versions.
Details
- CWE(s)